Medium — PCSE Practice Quiz

Question 1

A financial services company operating under strict regulatory requirements must ensure that no Google support or engineering personnel can access their customer data unless the company's own security team has explicitly granted permission for each access request. They already have Access Transparency logs enabled but want to move from passive visibility to active pre-authorization. Which capability should they configure to meet this requirement?

Accepted Answer

Enable Access Approval so that a designated approver in the organization must grant explicit consent before Google personnel can access covered resources

Answer

Configure Key Access Justifications with a policy that automatically denies all unjustified key access requests

Answer

Enable Data Access audit logs for all services so that every read of customer data is recorded for review

Answer

Deploy an Assured Workloads folder to restrict Google support personnel to in-region staff only

Question 2

A financial services company must document to their auditors that all Google personnel access to their production data is logged. Their compliance team wants to enable Access Transparency logs across the organization. During the enablement review, the security engineer discovers that Access Transparency is not available to activate for the organization. What is the most likely prerequisite the company has not met?

Accepted Answer

The organization does not have a qualifying support level such as Premium, Enhanced, or Platinum Support (or equivalent role-based support).

Answer

Data Access audit logs have not been enabled for all services in the organization.

Answer

The organization has not deployed an Assured Workloads folder for regulated data.

Answer

Access Approval has not been configured to require approval before support access.

Question 3

A financial services company is preparing documentation for an external auditor who is assessing the organization's ability to demonstrate oversight of any Google personnel access to customer content. The security team has already enabled Cloud Audit Logs (Admin Activity and Data Access). The auditor specifically asks for evidence showing when Google support or engineering staff accessed customer content, along with the justification for that access. Which action provides the required evidence?

Accepted Answer

Enable Access Transparency logs, which record actions taken by Google personnel on customer content, including the reason/justification for the access.

Answer

Enable Data Access audit logs for all services, since they capture every read and write of customer content including those performed by Google staff.

Answer

Configure Access Approval so that all Google personnel access is blocked, then export the denied-request records as audit evidence.

Answer

Create a log-based metric on Admin Activity logs to alert whenever a Google service account modifies IAM policy on customer resources.

Question 4

A financial services company must demonstrate to auditors that they have visibility into any actions Google Cloud support or engineering personnel take on their data, and that such access requires explicit organizational sign-off before it occurs. The compliance team has already enabled Access Transparency logs across the organization. During an audit rehearsal, they realize they cannot show evidence that Google personnel access was ever gated on their own approval. Which additional capability should they enable to meet the requirement that Google personnel access be explicitly authorized by the organization before it happens?

Accepted Answer

Access Approval, which requires the organization to grant explicit approval before Google personnel can access covered resources

Answer

Data Access audit logs, which record read and write operations performed on user data

Answer

Access Context Manager access levels that restrict console access to corporate IP ranges

Answer

Cloud Audit Logs Admin Activity logs, which capture configuration changes made by Google support

Question 5

A healthcare organization runs regulated workloads in an Assured Workloads folder configured for a US-based compliance regime. During a routine audit, the compliance team must demonstrate to regulators that Google support and engineering personnel cannot access customer content without a documented business justification, and that any such access is logged with a reason code. Which capability should the team point to as evidence of this control?

Accepted Answer

Access Transparency logs combined with Access Approval, which record and gate Google personnel access with justification reason codes

Answer

Key Access Justifications (KAJ), which requires an approved justification reason before Google can use a CMEK key to decrypt data

Answer

Cloud Audit Logs Admin Activity entries, which capture all administrative API calls made by customer identities

Answer

VPC Service Controls perimeters, which prevent data exfiltration by blocking API access from outside the perimeter

Question 6

A healthcare company runs regulated workloads in an Assured Workloads folder configured for a specific compliance regime. The compliance team needs an automated way to be alerted when a resource is created or modified in a way that violates the Assured Workloads controls (for example, a resource deployed outside the approved region), so they can document and remediate the drift. Which capability should they use?

Accepted Answer

Enable Assured Workloads monitoring, which surfaces compliance violations (such as resource location or configuration drift) in the console and can generate findings for review and remediation

Answer

Rely on Access Transparency logs to detect when resources drift from the approved compliance configuration

Answer

Configure a Cloud DLP inspection job to scan resources and flag those that violate the compliance regime

Answer

Use Cloud Billing budget alerts to detect resources deployed outside approved regions

Question 7

A financial services company already runs several production projects in a Google Cloud organization. New regulations now require that a subset of these workloads meet a specific compliance regime with strict data residency and personnel access controls. The security team wants to bring these workloads under Assured Workloads with the least effort while ensuring compliance controls are actually enforced. What is the correct approach?

Accepted Answer

Create a new Assured Workloads folder for the required compliance regime and provision new projects within it, then migrate the regulated workloads into those projects.

Answer

Apply an organization policy constraint that restricts resource locations to the compliant regions on the existing projects, which retroactively converts them into Assured Workloads environments.

Answer

Enable the Assured Workloads API on each existing project so its current resources are automatically brought into scope for the compliance regime.

Answer

Move the existing projects unchanged into a standard folder and rely on Access Transparency logs to demonstrate compliance with the residency and personnel requirements.

Question 8

A U.S. federal contractor must run a new workload on Google Cloud under FedRAMP Moderate authorization. During planning, an engineer proposes using an Assured Workloads folder configured for the FedRAMP Moderate control package. A developer asks to deploy a Google Cloud service that is NOT on the list of products supported by that Assured Workloads compliance regime. What is the correct guidance for maintaining compliance within the Assured Workloads folder?

Accepted Answer

Only services in the Assured Workloads supported-products list for FedRAMP Moderate may be used in the folder; using an unsupported service risks violating the compliance controls and should be avoided or flagged by the org policy restrictions Assured Workloads applies.

Answer

Assured Workloads will automatically bring the unsupported service into scope, so it can be used freely once deployed inside the folder.

Answer

Enable Access Transparency on the project, which retroactively certifies any service for FedRAMP Moderate.

Answer

Grant the developer a custom IAM role scoped to the unsupported service, which satisfies FedRAMP Moderate personnel controls.

Question 9

A US federal contractor must run a new workload in Google Cloud that handles Controlled Unclassified Information (CUI). Compliance requires that the data remain within US regions, that only US-based Google support personnel who have passed government background checks can access the environment, and that the control package aligns with the DoD Impact Level 4 (IL4) framework. The security team wants Google to enforce these constraints programmatically at folder creation rather than relying on manually applied org policies. What should they do?

Accepted Answer

Create an Assured Workloads folder using the DoD IL4 compliance regime, then deploy the workload resources into projects within that folder.

Answer

Apply a resource location org policy constraint restricting all resources to US regions and enable Access Transparency logs on the projects.

Answer

Enable VPC Service Controls with an access level requiring US corporate IP ranges, and configure CMEK with keys stored in US regions.

Answer

Purchase a Google Cloud premium support plan that guarantees US-based support engineers, then apply data residency org policies manually.

Question 10

A financial services company must demonstrate to auditors that all administrative configuration changes to Google Cloud resources over the past 18 months can be produced on demand. The compliance team discovers that Admin Activity audit logs are being relied upon for this evidence, but is concerned they will not satisfy the 18-month retention requirement. Which action correctly addresses this concern while minimizing operational overhead?

Accepted Answer

Admin Activity logs are retained by default for 400 days, so create a log sink that routes them to a log bucket or Cloud Storage with an 18-month retention policy

Answer

Enable Data Access audit logs for all services, since Admin Activity logs are only retained for 30 days

Answer

Manually export the _Required log bucket contents each week to a spreadsheet to preserve them beyond their default 30-day retention

Answer

Disable the _Required bucket and create a new default bucket with a custom retention period to capture Admin Activity logs

Question 11

A financial services company must be able to prove exactly which principals read the contents of sensitive objects in a specific Cloud Storage bucket during forensic investigations. During a recent incident, the security team discovered that Cloud Logging showed no records of object reads, only administrative changes to the bucket configuration. They need read operations to be captured going forward with minimal blast radius. What should the team configure?

Accepted Answer

Enable Data Access audit logs for the DATA_READ log type on the Cloud Storage service, scoping the configuration to the relevant project or resource.

Answer

Rely on Admin Activity audit logs, which are enabled by default and record all access to Cloud Storage objects.

Answer

Create a log-based metric on Admin Activity logs to alert whenever an object is downloaded from the bucket.

Answer

Enable VPC Flow Logs on the subnet used by clients accessing the bucket to capture object read activity.

Question 12

A financial services company must demonstrate to auditors that all reads and writes to a specific set of BigQuery datasets holding regulated customer data are logged, without incurring the cost and volume of enabling Data Access logs across every service in the organization. Their compliance mandate applies only to those datasets. What is the recommended approach to configure Data Access audit logs to satisfy this requirement efficiently?

Accepted Answer

Configure the IAM audit log settings to enable DATA_READ and DATA_WRITE for the BigQuery service scoped to the specific project containing the regulated datasets, and optionally use exempted members to reduce noise

Answer

Enable Data Access logs for the BigQuery service at the organization level and use log exclusion filters to drop everything except the regulated datasets

Answer

Rely on Admin Activity audit logs, which automatically capture all data read and write operations for regulated BigQuery datasets

Answer

Enable Access Transparency logs for the project, since they record all data access to customer data in the regulated datasets

Question 13

A compliance auditor asks your team to demonstrate which Cloud Audit Logs categories are always captured for a GCP organization without any administrator action to enable them, and which cannot be disabled. During a review, a security engineer claims that all audit log types must be explicitly enabled before they generate entries. Which statement correctly describes the default and configurability behavior of Cloud Audit Log types that you should document for the auditor?

Accepted Answer

Admin Activity and System Event logs are written by default and cannot be disabled, while Data Access logs (except BigQuery) are disabled by default and must be enabled.

Answer

All four audit log types (Admin Activity, System Event, Data Access, Policy Denied) are disabled by default and must be individually enabled in the organization's data access configuration.

Answer

Admin Activity logs are disabled by default but System Event and Data Access logs are always enabled and cannot be turned off.

Answer

Only Data Access logs are written by default; Admin Activity and System Event logs require enabling an audit configuration at the organization level.

Question 14

Your organization runs production workloads on a GKE cluster. Security policy requires that only container images built by the approved Cloud Build pipeline and scanned for vulnerabilities may be deployed. Developers must not be able to deploy arbitrary images pulled from public registries or built on their laptops. You need to enforce this at deploy time on the cluster. What should you implement?

Accepted Answer

Enable Binary Authorization on the cluster with a policy that requires attestations from the CI/CD attestor, and have Cloud Build create attestations only after successful vulnerability scanning.

Answer

Configure an Artifact Registry IAM policy that grants the developers only the Artifact Registry Reader role so they cannot push images.

Answer

Enable Container Analysis vulnerability scanning on Artifact Registry and configure Security Command Center to alert when a vulnerable image is deployed.

Answer

Apply a Pod Security Admission policy on the namespace that restricts images to a specific trusted registry hostname prefix.

Question 15

A company runs microservices on Cloud Run. The security team wants to guarantee that only container images built by the organization's trusted Cloud Build pipeline and stored in a specific Artifact Registry repository can be deployed to production Cloud Run services. Developers must not be able to deploy arbitrary public images. What is the most effective way to enforce this deployment control?

Accepted Answer

Enable Binary Authorization for Cloud Run and configure a policy requiring attestations from an attestor tied to the trusted build pipeline before any image can be deployed

Answer

Grant developers only the Cloud Run Viewer role so they cannot initiate deployments of untrusted images

Answer

Apply an organization policy constraint that restricts which external IP addresses Cloud Run services can egress to

Answer

Enable Artifact Registry vulnerability scanning and block deployment of any image with a CRITICAL CVE finding

Question 16

A retail company exposes a public web application through an external HTTP(S) load balancer. Recently, the application was targeted by SQL injection attempts and a volumetric flood of malicious requests from a handful of specific IP ranges. The security team wants to block the known bad IP ranges, mitigate common OWASP Top 10 attacks like SQL injection, and rate-limit abusive clients — all without modifying application code. Which approach should they implement?

Accepted Answer

Attach a Google Cloud Armor security policy to the load balancer backend service with deny rules for the IP ranges, preconfigured WAF rules for SQLi, and a rate-based ban rule.

Answer

Configure VPC firewall rules to deny the malicious IP ranges and enable Cloud NAT logging to detect SQL injection patterns.

Answer

Deploy Secure Web Proxy in front of the load balancer to filter inbound SQL injection traffic and enforce per-client rate limits.

Answer

Enable VPC Service Controls around the project and add the malicious IP ranges to an access level ingress deny list.

Question 17

A retail company exposes a public web application behind a global external Application Load Balancer. The security team must ensure that only traffic originating from the corporate offices' well-known egress IP ranges can reach the application, while all other public traffic is blocked at the network edge before hitting the backends. The list of corporate IP ranges is large and changes periodically as new offices open. Which approach best meets these requirements while minimizing maintenance overhead?

Accepted Answer

Attach a Cloud Armor security policy to the load balancer backend service with a default rule that denies traffic and a higher-priority allow rule that matches the corporate ranges using an address group referenced in the rule expression.

Answer

Create VPC ingress firewall rules on the backend instances that allow the corporate source ranges and deny 0.0.0.0/0, relying on the firewall to filter external client traffic.

Answer

Configure the load balancer's frontend forwarding rule to accept connections only from the corporate CIDR ranges specified directly in the forwarding rule configuration.

Answer

Enable Cloud NAT with a restricted set of external IPs and route all inbound application traffic through it so only corporate ranges are translated.

Question 18

A retail company runs a public API behind a global external Application Load Balancer. During flash sales, a small number of client IPs generate a massive volume of legitimate-looking requests that overwhelm backends, but the company does not want to fully block these clients — only slow them down when they exceed a fair usage threshold. Which Cloud Armor configuration meets this requirement?

Accepted Answer

Create a Cloud Armor security policy rule with action 'throttle' using rate-based ban keyed on the client IP, setting a request threshold and enforcement interval.

Answer

Create a Cloud Armor security policy rule with action 'deny(429)' matching all requests from the source region.

Answer

Enable Cloud Armor adaptive protection and rely on its automatic Layer 7 DDoS mitigation to drop excess traffic.

Answer

Configure a Cloud CDN cache policy to serve cached responses so the backends never receive the excess requests.

Question 19

Your organization uses Cloud Build to deploy applications to production Cloud Run services. The security team requires that any deployment targeting the production environment must be manually reviewed and explicitly approved by an authorized release manager before it executes, while builds to staging should continue to run automatically. You need to implement this control natively within the CI/CD pipeline with an auditable record of who approved each production deployment. What should you do?

Accepted Answer

Configure a Cloud Build trigger for production with manual approval required, and grant the release managers the Cloud Build Approver role so they can approve pending builds.

Answer

Enable Binary Authorization on the production Cloud Run service and require the release manager to sign each container image with a KMS key before deployment.

Answer

Add a wait step in the production build configuration that pauses for 24 hours and send an email to the release manager asking them to cancel it if the deployment is not authorized.

Answer

Create a Pub/Sub notification on the production trigger and require the release manager to publish an approval message to the topic before the build proceeds.

Question 20

Your organization runs CI/CD pipelines in Cloud Build to deploy applications to Cloud Run. A recent security review found that the pipelines use the default Cloud Build service account, which has broad Editor-level permissions across the project. A malicious commit could therefore let a build step create resources or modify IAM policies far beyond deployment needs. The security team wants to reduce the blast radius of a compromised build while keeping deployments functional. What is the most appropriate action?

Accepted Answer

Configure Cloud Build to run with a dedicated user-managed service account granted only the roles required to deploy to Cloud Run, and remove the Editor role from the default service account.

Answer

Enable Binary Authorization on the Cloud Run service so only signed images can be deployed by the default service account.

Answer

Store the build steps in a private repository and restrict who can push commits using branch protection rules.

Answer

Grant the default Cloud Build service account the Security Admin role so it can manage its own IAM bindings during the build.

Question 21

A financial services company runs its container build pipeline in Cloud Build, pushing images to Artifact Registry. Auditors require cryptographic proof of how each image was built, including the source commit and build steps, so that downstream Binary Authorization policies can verify that images originate only from the trusted pipeline. The security team wants to enable this evidence with minimal custom tooling. What should they do?

Accepted Answer

Enable build provenance generation in Cloud Build so it produces SLSA-compliant provenance metadata for each image, and configure a Binary Authorization policy that requires attestations validated against that provenance.

Answer

Write a custom Cloud Function that hashes each built image and stores the hash in a BigQuery table for auditors to query manually.

Answer

Enable Container Analysis vulnerability scanning on Artifact Registry and rely on the CVE findings as proof of build origin.

Answer

Sign each image manually with a Cloud KMS asymmetric key from a developer workstation before pushing to Artifact Registry.

Question 22

A financial services company must comply with a regulatory requirement that all cryptographic keys protecting customer payment data be generated and stored in hardware validated to FIPS 140-2 Level 3. The security team wants to use Cloud KMS to manage these keys but must ensure the private key material never exists outside a certified hardware boundary and cannot be exported. Which approach meets these requirements with the least operational overhead?

Accepted Answer

Create keys in Cloud HSM (a key ring with the HSM protection level), which generates and stores key material in FIPS 140-2 Level 3 validated hardware security modules

Answer

Create keys in a Cloud KMS key ring using the software protection level and enable key rotation every 90 days

Answer

Generate keys on-premises in an HSM appliance and import the wrapped key material into Cloud KMS as external keys

Answer

Use customer-supplied encryption keys (CSEK) so the company retains full control of the raw key material

Question 23

A company uses Okta as its primary identity provider and Google Cloud with Cloud Identity for its cloud resources. The security team wants new employees added in Okta to be automatically created as Cloud Identity users, and departing employees to be automatically suspended in Cloud Identity when disabled in Okta — all without deploying or maintaining any server infrastructure on-premises. Which approach should they implement?

Accepted Answer

Configure automated user provisioning in Okta using the SCIM-based Google Cloud/Google Workspace provisioning integration to push user lifecycle changes to Cloud Identity

Answer

Deploy Google Cloud Directory Sync (GCDS) on a Compute Engine VM and schedule it to sync the Okta user directory to Cloud Identity

Answer

Enable SAML SSO between Okta and Cloud Identity, which automatically provisions and deprovisions users on each sign-in event

Answer

Write a custom script using the Directory API and run it as a cron job on an on-premises server to poll Okta and update Cloud Identity

Question 24

A financial services company uses Cloud Identity as its identity provider and has hundreds of employees who frequently change roles between the 'Data Analysts', 'Data Engineers', and 'Auditors' teams. The security team is frustrated because IAM bindings are granted directly to individual user accounts, causing access drift and lengthy offboarding when people move teams. They want a scalable approach that lets access follow team membership and simplifies audits. What should they implement?

Accepted Answer

Create Google Groups in Cloud Identity for each team, grant IAM roles to the groups at the appropriate resource level, and manage access by adjusting group membership.

Answer

Grant each user the Owner role at the organization level and use IAM Conditions to restrict what resources they can touch based on job title attributes.

Answer

Create a separate service account for each team and have employees impersonate the relevant service account when they need access.

Answer

Assign IAM roles directly to individual users but automate the binding changes with a nightly script that reconciles a spreadsheet of team assignments.

Question 25

Your organization already manages employee identities in an on-premises Active Directory and a third-party identity provider (Okta) that supports SAML 2.0. Leadership wants employees to sign in to Google Cloud using their existing Okta credentials, and wants Okta to remain the authoritative source for authentication. You must ensure that when users authenticate, they are redirected to Okta and that Google Cloud does not store or validate their passwords. What should you configure?

Accepted Answer

Configure Cloud Identity with third-party SSO by setting Okta as the SAML identity provider (IdP) and Cloud Identity as the service provider (SP).

Answer

Enable Google Cloud Directory Sync (GCDS) and let it synchronize password hashes from Active Directory to Cloud Identity.

Answer

Create all users manually in the Cloud Identity Admin console and enforce 2-Step Verification for each account.

Answer

Configure workload identity federation so Okta issues tokens that map to Google Cloud service accounts for each employee.